Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cherokee_httpd | Cherokee | 0.1 (including) | 0.1 (including) |
| Cherokee_httpd | Cherokee | 0.1.5 (including) | 0.1.5 (including) |
| Cherokee_httpd | Cherokee | 0.1.6 (including) | 0.1.6 (including) |
| Cherokee_httpd | Cherokee | 0.2 (including) | 0.2 (including) |
| Cherokee_httpd | Cherokee | 0.2.5 (including) | 0.2.5 (including) |
| Cherokee_httpd | Cherokee | 0.2.6 (including) | 0.2.6 (including) |
| Cherokee_httpd | Cherokee | 0.2.7 (including) | 0.2.7 (including) |
| Cherokee_httpd | Cherokee | 0.4.6 (including) | 0.4.6 (including) |
| Cherokee_httpd | Cherokee | 0.4.7 (including) | 0.4.7 (including) |
| Cherokee_httpd | Cherokee | 0.4.8 (including) | 0.4.8 (including) |
| Cherokee_httpd | Cherokee | 0.4.9 (including) | 0.4.9 (including) |
| Cherokee_httpd | Cherokee | 0.4.17 (including) | 0.4.17 (including) |
| Cherokee_httpd | Cherokee | 0.5 (including) | 0.5 (including) |